Geeks To Go is a helpful hub, where thousands of volunteer geeks quickly serve friendly answers and support. Check out the forums and get free advice from the experts. Register now to gain access to all of our features, it's FREE and only takes one minute. Once registered and logged in, you will be able to create topics, post replies to existing threads, give reputation to your fellow members, get your own private messenger, post status updates, manage your profile and so much more.

IE Pop-up - HiJack Log [RESOLVED]

bluezwalk

Posted 17 July 2005 - 09:30 PM

bluezwalk

New Member

Member

4 posts

Hi - I'm a newbie, but think this is a really cool forum. I did all the begining stuff (steps 1-4 - scanned with ad-aware, spybot, ewido) - removed/quarentined a lot of stuff, but still have my problem. Upon startup IE opens and to about:blank and some links have been added to my favorites. Here's the HiJackThis log...

Advertisements

Trevuren

Posted 17 July 2005 - 09:53 PM

Trevuren

Old Dog

Retired Staff

18,699 posts

You have a serious infection from a variant of the About:Blank infection. This infection can become very difficult to manage. There are 2 approaches to solving this problem, one is easier on the victim than the other so I will try this one first. If this does not succeed right away, we will have to move on to the second approach.

Please print out or copy this page to Notepad. Make sure to work through the fixes in the exact order in which they are mentioned below. If there's anything that you don't understand, ask your question(s) before proceeding with the fixes.

Please download and install these programs -DON'T RUN THEM YET!!

Please download and unzip About:Buster to a folder on your Desktop. Inside the folder is a readme file that has instructions on the use of the program.

AboutBuster MUST be updated before you use it.

Start AboutBuster, click the update button, check for update, drag the box to the side and hit download updates, close the box .Don't run it yet.

Please download and install AD-Aware.Check Here on how setup and use it - please make sure you update it first.

Click on the View tab and make sure that "Show hidden files and folders" is checked.

Also uncheck "Hide protected operating system files" and untick "hide extensions for known file types" .

Now click "Apply to all folders"

Click "Apply" then "OK"

For anyone using Windows XP, 'Search' will not automatically show hidden files even if your folder options settings are set to do that.Do this so you can see hidden files and folders - click HERE to download XPhidden.zip by David Higham. Extract xphidden.reg from the zip file and save it to the desktop. When done, double-click the xphidden.reg and when asked to merge say yes.

(and any other files with the same name that end in .dll, .exe or .dat, you may find them right next to each other, example - appsw.exe, appsw.dll, appsw.dat)

7. Run AboutBuster . This will scan your computer for the bad files and delete them. Save the report (copy and paste into notepad or wordpad and save as a .txt file) and post a copy back here when you are done with all the steps.

8. Scan with AdAware and let it remove any bad files found.

9. Clean out temporary and TIF files. Go to Start > Run and type in the box: cleanmgr. Let it scan your system for files to remove. Make sure these 3 are checked and then press *ok* to remove:

Temporary Files

Temporary Internet Files

Recycle Bin

10. Double click on the HSfix and when asked to merge say yes.

11. Run CW-Shredder - Hit the FIX button - let it run and fix what it finds.

8. Start AboutBuster and press start, and then OK. The program will start scanning now.

9. Doubleclick HomeSearchfix.reg to merge the info to the registry.

10. Start Killbox place a tick next to [x]delete on reboot.Copy this file into the windows clipboard.

C:\WINDOWS\cnryp.dll

Back in Killbox go > file > paste from clipboard,Click the red highlighted X button and say yes to the prompt if all the files have been put there, then click OK.Exit Killbox and restart your PC.

After the reboot, start AboutBuster AGAIN and scan AGAIN.

11. To clean temporary files:Go > start > run and type cleanmgr and OKScan your system for files to remove.Make sure Temporary Files, Temporary Internet Files and Recycle Bin are the only things checked.Click OK to remove those files.Click Yes to confirm deletion.

Trevuren

Posted 19 July 2005 - 10:52 AM

1. Reset and Re-enable your System Restore to remove bad files from the backup that Windows makes as no program is able to clean those files:

TO DISABLE SYSTEM RESTORE1. Right-click "My Computer", and then left click "Properties".2. Left click on "System Restore Tab"3. Check box beside "Turn Off System Restore"4. Left click on "Apply"

TO ENABLE SYSTEM RESTORE1.Remove check mark from "Turn Off System Restore"2.Click on "Apply"

2. Cleanup the leftovers. Download CleanUP! - Cleans temporary files from IE and Windows, empties the recycle bin and more. Great tool to help speed up your computer and knock out those nasties that like to reside in the temp folders.

3. Finally, Re-hide your System Files and Folders to prevent any future accidents.

Here are some tips to reduce the potential for spyware infection in the future:

Make sure you keep your Windows OS current by visiting Windows updateregularly to download and install any critical updates and service packs. With out these you are leaving the backdoor open.

I strongly recommend installing the following applications:

Spywareblaster<=SpywareBlaster will prevent spyware from being installed.

How to use Spybot to remove Spyware<=If you suspect that you have spyware installed on your computer, here are instructions on how to download, install and then use Spybot. Similar to Ad-Aware, I strongly recommend both to catch most spyware.

To protect yourself further:

Spyad<=IE/Spyad places over 4000 websites and domains in the IE Restricted list which will severely impair attempts to infect your system. It basically prevents any downloads (Cookies etc) from the sites listed, although you will still be able to connect to the sites.

MVPS Hosts file<=The MVPS Hosts file replaces your current HOSTS file with one containing well know ad sites etc. Basically, this prevents your coputer from connecting to those sites by redirecting them to 127.0.0.1 which is your local computer

Google Toolbar<=Get the free google toolbar to help stop pop up windows.